@sanity/sdk 3.1.0 → 3.3.0-rc.0

package/dist/index.js

@@ -1,8 +1,10 @@
-import { D as configureLogging$1, E as getAuthLogger, O as createLogger, S as AuthStateType, T as REQUEST_TAG_PREFIX, b as getTokenFromLocation, c as getDashboardOrganizationId, d as getTokenState, f as setAuthToken, h as getCleanedUrl, i as authStore, l as getIsInDashboardState, m as getAuthCode, n as getClient, o as getAuthState, p as createLoggedInAuthState, r as getClientState, s as getCurrentUserState, u as getLoginUrlState, w as DEFAULT_API_VERSION, y as getDefaultLocation } from "./clientStore-gUALQ0qW.js";
-import { a as createStateSourceAction, c as bindActionGlobally, d as isReleasePerspective, f as isCanvasResource, l as defineStore, m as isMediaLibraryResource, o as bindActionByResource, p as isDatasetResource, r as omitProperty, s as bindActionByResourceAndPerspective, t as isDeepEqual } from "./object-BwynGPRZ.js";
-import { A as clearPendingTransaction, B as assertDatasetResource, C as getCommentsState, D as toCommentsKeyParts, E as resolveComments, F as rollbackCommentUpdate, G as defineMutation, H as provisionAddonDataset, I as setCommentCreateError, K as randomId, L as setPendingTransaction, M as receiveComment, N as removeCommentById, O as addComment, P as restoreComments, R as normalizeComment, T as resolveCommentThreads, U as COMMENTS_API_VERSION, V as getAddonDatasetState, W as defineFetcher, _ as updateLastLoadMoreRequest, a as resolveQuery, b as commentsStore, c as getAllReleasesState, d as getUsersKey, f as initializeRequest, g as setUsersError, h as setUsersData, j as getCommentsKey, k as applyCommentUpdate, l as addSubscription, m as removeSubscription, o as getPerspectiveState, p as parseUsersKey, q as randomUuid, r as getQueryState, s as getActiveReleasesState, t as CORE_SDK_VERSION, u as cancelRequest, v as PROJECT_API_VERSION, x as getCommentThreadsState, y as USERS_STATE_CLEAR_DELAY, z as toCommentFieldPath } from "./version-C90rNWaX.js";
+import { D as getAuthLogger, E as REQUEST_TAG_PREFIX, O as configureLogging$1, S as AuthStateType, T as DEFAULT_BASE, b as getTokenFromLocation, c as getDashboardOrganizationId, d as getTokenState, f as setAuthToken, h as getCleanedUrl, i as authStore, k as createLogger, l as getIsInDashboardState, m as getAuthCode, n as getClient, o as getAuthState, p as createLoggedInAuthState, r as getClientState, s as getCurrentUserState, u as getLoginUrlState, w as DEFAULT_API_VERSION, y as getDefaultLocation } from "./clientStore-QDrJNTM4.js";
+import { c as isReleasePerspective, d as isMediaLibraryResource, i as bindActionGlobally, l as isCanvasResource, n as bindActionByResource, o as defineStore, r as bindActionByResourceAndPerspective, t as createStateSourceAction, u as isDatasetResource } from "./createStateSourceAction-DdAhEfnZ.js";
+import { A as clearPendingTransaction, B as assertDatasetResource, C as getCommentsState, D as toCommentsKeyParts, E as resolveComments, F as rollbackCommentUpdate, G as defineMutation, H as provisionAddonDataset, I as setCommentCreateError, K as randomId, L as setPendingTransaction, M as receiveComment, N as removeCommentById, O as addComment, P as restoreComments, R as normalizeComment, T as resolveCommentThreads, U as COMMENTS_API_VERSION, V as getAddonDatasetState, W as defineFetcher, _ as updateLastLoadMoreRequest, a as resolveQuery, b as commentsStore, c as getAllReleasesState, d as getUsersKey, f as initializeRequest, g as setUsersError, h as setUsersData, j as getCommentsKey, k as applyCommentUpdate, l as addSubscription, m as removeSubscription, o as getPerspectiveState, p as parseUsersKey, q as randomUuid, r as getQueryState, s as getActiveReleasesState, t as CORE_SDK_VERSION, u as cancelRequest, v as PROJECT_API_VERSION, x as getCommentThreadsState, y as USERS_STATE_CLEAR_DELAY, z as toCommentFieldPath } from "./version-CIhX5ppJ.js";
+import { r as omitProperty, t as isDeepEqual } from "./object-CxXlSVg7.js";
 import { n as setCleanupTimeout } from "./setCleanupTimeout-BiM6q1KF.js";
-import { t as getNodeState } from "./getNodeState-E0hjqFOo.js";
+import { t as _defineProperty } from "./defineProperty-Bho9Ngsi.js";
+import { t as getNodeState } from "./getNodeState-B4nG0sjm.js";
 import { ClientError, CorsOriginError } from "@sanity/client";
 import { EMPTY, NEVER, Observable, Subject, Subscription, auditTime, catchError, combineLatest, concat, concatMap, debounceTime, defer, distinctUntilChanged, filter, first, firstValueFrom, from, fromEvent, groupBy, map, merge, mergeMap, of, pairwise, partition, race, retry, share, shareReplay, skip, startWith, switchMap, take, takeUntil, tap, throttle, throwError, timer, withLatestFrom } from "rxjs";
 import { isKeySegment, isKeyedObject } from "@sanity/types";
@@ -10,7 +12,6 @@ import { DocumentId, getDraftId, getPublishedId, getVersionId, isDraftId, isPubl
 import { getIndexForKey, getIndexForKey as getIndexForKey$1, getPathDepth, joinPaths, jsonMatch, jsonMatch as jsonMatch$1, slicePath, slicePath as slicePath$1, stringifyPath, stringifyPath as stringifyPath$1 } from "@sanity/json-match";
 import { SanityEncoder } from "@sanity/mutate";
 import { createDocumentLoaderFromClient } from "@sanity/mutate/_unstable_store";
-import "groq";
 import { evaluateSync, parse } from "groq-js";
 import { catchError as catchError$1, distinctUntilChanged as distinctUntilChanged$1, map as map$1, mergeMap as mergeMap$1, retry as retry$1, scan, share as share$1, switchMap as switchMap$1 } from "rxjs/operators";
 import { applyPatches, parsePatch } from "@sanity/diff-match-patch";
@@ -302,11 +303,295 @@ function observeOrganizationVerificationState(instance, projectIds) {
 	}), distinctUntilChanged((prev, curr) => prev.error === curr.error));
 }
 /**
+* Encodes a byte array as a base64url string (RFC 4648 §5) with no padding,
+* as required for PKCE `code_verifier`/`code_challenge` values.
+*
+* @internal
+*/
+function base64UrlEncode(bytes) {
+	let binary = "";
+	for (let byte of bytes) binary += String.fromCharCode(byte);
+	return btoa(binary).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
+}
+function randomString() {
+	let bytes = /* @__PURE__ */ new Uint8Array(32);
+	return crypto.getRandomValues(bytes), base64UrlEncode(bytes);
+}
+/**
+* Generates a PKCE `code_verifier`
+*
+* @internal
+*/
+function generateCodeVerifier() {
+	return randomString();
+}
+/**
+* Generates the `state` parameter used to defend against CSRF on the OAuth
+* callback.
+*
+* @internal
+*/
+function generateState() {
+	return randomString();
+}
+/**
+* Derives the PKCE `code_challenge` from a `code_verifier` using
+* `base64url(sha256(verifier))` (the `S256` method).
+*
+* @internal
+*/
+async function generateCodeChallenge(codeVerifier) {
+	let data = new TextEncoder().encode(codeVerifier), digest = await crypto.subtle.digest("SHA-256", data);
+	return base64UrlEncode(new Uint8Array(digest));
+}
+/** sessionStorage key for the PKCE `code_verifier`. */
+const OAUTH_VERIFIER_KEY = "__sanity_oauth_verifier", OAUTH_STATE_KEY = "__sanity_oauth_state", OAUTH_RETURN_TO_KEY = "__sanity_oauth_return_to", OAUTH_CALLBACK_PARAMS = [
+	"code",
+	"state",
+	"error",
+	"error_description"
+];
+/** Strips the OAuth callback params from a URL. */
+function stripOAuthParams(href) {
+	let url = new URL(href, DEFAULT_BASE);
+	for (let param of OAUTH_CALLBACK_PARAMS) url.searchParams.delete(param);
+	return url.toString();
+}
+/** Whether `href` is the registered redirect URI (origin + pathname; query and hash ignored). */
+function isCallbackRoute(href, redirectUri) {
+	let current = new URL(href, DEFAULT_BASE), redirect = new URL(redirectUri, DEFAULT_BASE);
+	return current.origin === redirect.origin && current.pathname === redirect.pathname;
+}
+/** Builds the RFC 8707 resource indicator for an organisation. */
+function getResourceIndicator(organizationId) {
+	return `urn:io.sanity:organization:${organizationId}`;
+}
+/**
+* Serialises tokens for storage, converting `expiresAt` to an ISO string.
+*
+* @internal
+*/
+function serializeTokens(tokens) {
+	return JSON.stringify({
+		accessToken: tokens.accessToken,
+		tokenType: tokens.tokenType,
+		expiresIn: tokens.expiresIn,
+		expiresAt: tokens.expiresAt.toISOString(),
+		...tokens.refreshToken !== void 0 && { refreshToken: tokens.refreshToken }
+	});
+}
+/**
+* Reads the store options, throwing when the instance was not configured for
+* OAuth.
+*/
+function getOAuthOptions(state) {
+	let { options } = state;
+	if (!options.oauth) throw Error("OAuth is not configured on this instance (missing `auth.oauth`).");
+	return options;
+}
+/** Creates a client for the (unauthenticated) public OAuth token/revoke calls. */
+function createOAuthClient(options) {
+	return options.clientFactory({
+		apiVersion: "v1",
+		requestTagPrefix: REQUEST_TAG_PREFIX,
+		useProjectHostname: !1,
+		useCdn: !1,
+		...options.apiHost && { apiHost: options.apiHost }
+	});
+}
+/** Converts a token endpoint response to the {@link OAuthTokens} shape. */
+function toOAuthTokens(response) {
+	return {
+		accessToken: response.access_token,
+		tokenType: "bearer",
+		expiresIn: response.expires_in,
+		expiresAt: new Date(Date.now() + response.expires_in * 1e3),
+		...response.refresh_token !== void 0 && { refreshToken: response.refresh_token }
+	};
+}
+/**
+* Starts the OAuth authorization-code + PKCE flow: generates a `code_verifier`,
+* `code_challenge` and `state`, persists the verifier and state to
+* `sessionStorage`, then navigates the browser to the authorize endpoint.
+*
+* @public
+*/
+const startOAuthAuthorization = bindActionGlobally(authStore, async ({ state, instance }) => {
+	let logger = getAuthLogger(instance), options = getOAuthOptions(state.get()), codeVerifier = generateCodeVerifier(), oauthState = generateState(), codeChallenge = await generateCodeChallenge(codeVerifier), session = typeof sessionStorage < "u" ? sessionStorage : void 0;
+	session?.setItem(OAUTH_VERIFIER_KEY, codeVerifier), session?.setItem(OAUTH_STATE_KEY, oauthState);
+	let currentHref = getDefaultLocation();
+	if (currentHref !== "http://localhost") {
+		let returnTo = isCallbackRoute(currentHref, options.oauth.redirectUri) ? stripOAuthParams(currentHref) : currentHref;
+		session?.setItem(OAUTH_RETURN_TO_KEY, returnTo);
+	}
+	let authorizeUrl = new URL("/v1/auth/oauth/authorize", options.apiHost ?? "https://api.sanity.io");
+	authorizeUrl.searchParams.set("response_type", "code"), authorizeUrl.searchParams.set("client_id", options.oauth.clientId), authorizeUrl.searchParams.set("redirect_uri", options.oauth.redirectUri), authorizeUrl.searchParams.set("state", oauthState), authorizeUrl.searchParams.set("code_challenge", codeChallenge), authorizeUrl.searchParams.set("code_challenge_method", "S256"), authorizeUrl.searchParams.append("resource", getResourceIndicator(options.oauth.organizationId)), logger.info("Starting OAuth authorization"), typeof window < "u" && typeof window.location?.assign == "function" && window.location.assign(authorizeUrl.toString());
+}), handleOAuthCallback = bindActionGlobally(authStore, async ({ state, instance }, locationHref = getDefaultLocation()) => {
+	let logger = getAuthLogger(instance), options = getOAuthOptions(state.get()), { authState } = state.get();
+	if (authState.type === "logging-in" && authState.isExchangingToken) return logger.debug("Skipping OAuth callback - token exchange already in progress"), !1;
+	let callbackUrl = new URL(locationHref, DEFAULT_BASE), code = callbackUrl.searchParams.get("code"), returnedState = callbackUrl.searchParams.get("state"), error = callbackUrl.searchParams.get("error"), errorDescription = callbackUrl.searchParams.get("error_description"), session = typeof sessionStorage < "u" ? sessionStorage : void 0, cleanedUrl = stripOAuthParams(locationHref), rejectCallback = (name, message) => authState.type === "logged-in" ? (logger.warn(`${message} — ignoring callback, session already established`), cleanedUrl) : (logger.error(`${message} — rejecting callback`), clearOAuthArtifacts(session), state.set(name, { authState: {
+		type: "error",
+		error: Error(message)
+	} }), cleanedUrl);
+	if (error) return rejectCallback("oauthCallbackError", errorDescription ? `${error}: ${errorDescription}` : error);
+	if (!code) return logger.debug("No OAuth code found in callback URL"), !1;
+	let storedState = session?.getItem("__sanity_oauth_state") ?? null;
+	if (!returnedState || !storedState || returnedState !== storedState) return rejectCallback("oauthStateMismatch", "OAuth state mismatch");
+	let codeVerifier = session?.getItem("__sanity_oauth_verifier") ?? null;
+	if (!codeVerifier) return rejectCallback("oauthVerifierMissing", "OAuth code verifier missing");
+	logger.info("Exchanging OAuth code for tokens"), state.set("oauthExchange", { authState: {
+		type: "logging-in",
+		isExchangingToken: !0
+	} });
+	try {
+		let client = createOAuthClient(options), params = new URLSearchParams({
+			grant_type: "authorization_code",
+			code,
+			code_verifier: codeVerifier,
+			redirect_uri: options.oauth.redirectUri,
+			client_id: options.oauth.clientId,
+			resource: getResourceIndicator(options.oauth.organizationId)
+		}), tokens = toOAuthTokens(await client.request({
+			method: "POST",
+			url: "/auth/oauth/token",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: params.toString(),
+			tag: "oauth.token"
+		}));
+		options.storageArea?.setItem(options.storageKey, serializeTokens(tokens));
+		let returnTo = getSameOriginReturnTo(session, options.oauth.redirectUri);
+		return clearOAuthArtifacts(session), logger.info("OAuth tokens obtained, user logged in"), state.set("oauthLoggedIn", {
+			authState: createLoggedInAuthState(tokens.accessToken, null),
+			oauthTokens: tokens
+		}), returnTo ?? cleanedUrl;
+	} catch (exchangeError) {
+		return logger.error("Failed to exchange OAuth code for tokens", { error: exchangeError }), clearOAuthArtifacts(session), state.set("oauthExchangeError", { authState: {
+			type: "error",
+			error: exchangeError
+		} }), cleanedUrl;
+	}
+});
+/**
+* A refresh failure is unrecoverable only when the token endpoint rejects the
+* refresh token itself (a 4xx). Rate-limit (429) and request-timeout (408)
+* responses, 5xx errors and network failures are transient, so the session is
+* kept intact for the caller to retry rather than forcing a logout.
+*/
+function isUnrecoverableRefreshError(error) {
+	return error instanceof ClientError && error.statusCode !== 408 && error.statusCode !== 429;
+}
+let refreshInFlight = null;
+/**
+* Refreshes the OAuth tokens using the `refresh_token` grant. Concurrent
+* callers share a single in-flight request. An unrecoverable failure (a 4xx
+* rejecting the refresh token) clears the tokens and transitions to
+* `LOGGED_OUT`; transient failures (network, 5xx, rate limits) leave the
+* session intact and rethrow so the caller can retry.
+*
+* @public
+*/
+const refreshOAuthTokens = bindActionGlobally(authStore, (context) => refreshInFlight || (refreshInFlight = doRefreshOAuthTokens(context).finally(() => {
+	refreshInFlight = null;
+}), refreshInFlight));
+async function doRefreshOAuthTokens({ state, instance }) {
+	let logger = getAuthLogger(instance), options = getOAuthOptions(state.get()), current = state.get().oauthTokens;
+	if (!current?.refreshToken) return logger.warn("No refresh token available — logging out"), options.storageArea?.removeItem(options.storageKey), state.set("oauthRefreshNoToken", {
+		authState: {
+			type: "logged-out",
+			isDestroyingSession: !1
+		},
+		oauthTokens: void 0
+	}), null;
+	try {
+		let client = createOAuthClient(options), params = new URLSearchParams({
+			grant_type: "refresh_token",
+			refresh_token: current.refreshToken,
+			client_id: options.oauth.clientId,
+			resource: getResourceIndicator(options.oauth.organizationId)
+		}), tokens = toOAuthTokens(await client.request({
+			method: "POST",
+			url: "/auth/oauth/token",
+			headers: { "content-type": "application/x-www-form-urlencoded" },
+			body: params.toString(),
+			tag: "oauth.refresh"
+		}));
+		return tokens.refreshToken ||= current.refreshToken, options.storageArea?.setItem(options.storageKey, serializeTokens(tokens)), logger.info("OAuth tokens refreshed"), state.set("oauthRefreshed", {
+			authState: createLoggedInAuthState(tokens.accessToken, null),
+			oauthTokens: tokens
+		}), tokens;
+	} catch (error) {
+		throw isUnrecoverableRefreshError(error) ? (logger.error("OAuth token refresh failed — logging out", { error }), options.storageArea?.removeItem(options.storageKey), state.set("oauthRefreshFailed", {
+			authState: {
+				type: "logged-out",
+				isDestroyingSession: !1
+			},
+			oauthTokens: void 0
+		}), error) : (logger.warn("OAuth token refresh failed — keeping session for retry", { error }), error);
+	}
+}
+/**
+* Revokes the OAuth tokens then clears local storage and transitions to `LOGGED_OUT`.
+* Local state is cleared even if the revoke request fails.
+*
+* @public
+*/
+const revokeOAuthTokens = bindActionGlobally(authStore, async ({ state, instance }) => {
+	let logger = getAuthLogger(instance), options = getOAuthOptions(state.get()), current = state.get().oauthTokens, token = current?.refreshToken ?? current?.accessToken;
+	try {
+		if (token) {
+			let client = createOAuthClient(options), params = new URLSearchParams({
+				token,
+				client_id: options.oauth.clientId
+			});
+			await client.request({
+				method: "POST",
+				url: "/auth/oauth/revoke",
+				headers: { "content-type": "application/x-www-form-urlencoded" },
+				body: params.toString(),
+				tag: "oauth.revoke"
+			}), logger.info("OAuth tokens revoked");
+		}
+	} catch (error) {
+		logger.warn("OAuth revoke request failed — clearing local state anyway", { error });
+	} finally {
+		options.storageArea?.removeItem(options.storageKey), state.set("oauthRevoked", {
+			authState: {
+				type: "logged-out",
+				isDestroyingSession: !1
+			},
+			oauthTokens: void 0
+		});
+	}
+}), getOAuthTokensState = bindActionGlobally(authStore, createStateSourceAction(({ state }) => state.oauthTokens ?? null));
+/** Removes the transient PKCE artifacts from session storage. */
+function clearOAuthArtifacts(session) {
+	session?.removeItem(OAUTH_VERIFIER_KEY), session?.removeItem(OAUTH_STATE_KEY), session?.removeItem(OAUTH_RETURN_TO_KEY);
+}
+/**
+* Reads the stashed pre-authorize location, only honouring it when it shares
+* the registered redirect URI's origin so a tampered value cannot redirect
+* off-site. (`origin` includes the scheme, so non-http(s) URLs are rejected.)
+*/
+function getSameOriginReturnTo(session, redirectUri) {
+	let returnTo = session?.getItem("__sanity_oauth_return_to") ?? null;
+	if (!returnTo) return null;
+	try {
+		return new URL(returnTo).origin === new URL(redirectUri).origin ? returnTo : null;
+	} catch {
+		return null;
+	}
+}
+/**
+* Handles the auth redirect callback. In OAuth mode this delegates to
+* {@link handleOAuthCallback}; otherwise it exchanges the legacy `sid` for a
+* long-lived token.
+*
 * @public
 */
 const handleAuthCallback = bindActionGlobally(authStore, async ({ state, instance }, locationHref = getDefaultLocation()) => {
-	let logger = getAuthLogger(instance), { providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey } = state.get().options;
+	let logger = getAuthLogger(instance), { providedToken, callbackUrl, clientFactory, apiHost, storageArea, storageKey, oauth } = state.get().options;
 	if (providedToken) return logger.debug("Skipping auth callback - token already provided"), !1;
+	if (oauth) return logger.debug("OAuth mode - delegating to handleOAuthCallback"), handleOAuthCallback(instance, locationHref);
 	let { authState } = state.get();
 	if (authState.type === "logging-in" && authState.isExchangingToken) return logger.debug("Skipping auth callback - token exchange already in progress"), !1;
 	let cleanedUrl = getCleanedUrl(locationHref), tokenFromUrl = getTokenFromLocation(locationHref);
@@ -353,7 +638,7 @@ const handleAuthCallback = bindActionGlobally(authStore, async ({ state, instanc
 		} }), cleanedUrl;
 	}
 }), logout = bindActionGlobally(authStore, async ({ state, instance }) => {
-	let logger = getAuthLogger(instance), { clientFactory, apiHost, providedToken, storageArea, storageKey } = state.get().options;
+	let logger = getAuthLogger(instance), { clientFactory, apiHost, providedToken, storageArea, storageKey, oauth } = state.get().options;
 	if (providedToken) {
 		logger.debug("Skipping logout - token is statically provided");
 		return;
@@ -363,6 +648,13 @@ const handleAuthCallback = bindActionGlobally(authStore, async ({ state, instanc
 		logger.debug("Skipping logout - already in progress");
 		return;
 	}
+	if (oauth) {
+		logger.debug("OAuth mode - revoking tokens instead of calling /auth/logout"), state.set("loggingOut", { authState: {
+			type: "logged-out",
+			isDestroyingSession: !0
+		} }), await revokeOAuthTokens(instance);
+		return;
+	}
 	let token = authState.type === "logged-in" && authState.token;
 	try {
 		if (token) {
@@ -387,10 +679,13 @@ const handleAuthCallback = bindActionGlobally(authStore, async ({ state, instanc
 	} catch (error) {
 		throw logger.error("Logout request failed", { error }), error;
 	} finally {
-		logger.info("User logged out, clearing stored tokens"), state.set("logoutSuccess", { authState: {
-			type: "logged-out",
-			isDestroyingSession: !1
-		} }), storageArea?.removeItem(storageKey), storageArea?.removeItem(`${storageKey}_last_refresh`);
+		logger.info("User logged out, clearing stored tokens"), state.set("logoutSuccess", {
+			authState: {
+				type: "logged-out",
+				isDestroyingSession: !1
+			},
+			oauthTokens: void 0
+		}), storageArea?.removeItem(storageKey), storageArea?.removeItem(`${storageKey}_last_refresh`);
 	}
 });
 function weaken(node) {
@@ -1228,7 +1523,29 @@ function unsetDeep(input, path) {
 	let segment = _segment;
 	return typeof segment == "number" && Array.isArray(input) && (segment = segment < 0 ? input.length + segment : segment), segment in input ? restOfPath.length ? Array.isArray(input) ? input.map((nestedInput, index) => index === segment ? unsetDeep(nestedInput, restOfPath) : nestedInput) : Object.fromEntries(Object.entries(input).map(([key, value]) => key === segment ? [key, unsetDeep(value, restOfPath)] : [key, value])) : Array.isArray(input) ? input.filter((_nestedInput, index) => index !== segment) : Object.fromEntries(Object.entries(input).filter(([key]) => key !== segment.toString())) : input;
 }
-const patchOperations = {
+/**
+* Exposes the patch operations used by {@link processMutations}.
+*
+* @remarks
+* Property order determines execution order in {@link processMutations}:
+* `ifRevisionID`, `set`, `setIfMissing`, `unset`, `inc`, `dec`, `insert`,
+* then `diffMatchPatch`. Reordering the properties changes mutation results.
+* Freezes the collection to prevent callers from replacing the functions
+* used by the SDK's mutation evaluator.
+*
+* @see https://www.sanity.io/docs/http-mutations#5b4db1396e56
+*
+* @example
+* ```ts
+* const document = {items: [{_key: 'a', title: 'Before'}]}
+* const updated = patchOperations.set<typeof document>(document, {
+*   'items[_key=="a"].title': 'After',
+* })
+* ```
+*
+* @internal
+*/
+const patchOperations = Object.freeze({
 	ifRevisionID,
 	set,
 	setIfMissing,
@@ -1237,7 +1554,7 @@ const patchOperations = {
 	dec,
 	insert,
 	diffMatchPatch
-};
+});
 /**
 * Implements ID generation:
 *
@@ -1265,18 +1582,31 @@ function getDocumentIds(selection) {
 	return [];
 }
 /**
-* Applies the given mutation to the given document set. Note, it is expected
-* that all relevant documents that the mutations affect should be within the
-* given `document` set. If a document does not exist, it should have the value
-* `null`. If a document is deleted as a result of the mutations, it will still
-* have its document ID present in the returns documents, but it will have a
-* value of `null`.
+* Applies mutations to an in-memory set of Sanity documents.
+* Deleted documents remain in the returned set with a value of `null`.
+*
+* Include every document affected by `mutations` in `documents`, using `null`
+* for documents that do not exist.
+*
+* Returns `documents` itself when `mutations` is empty. Otherwise, returns a
+* shallow copy of that object. The result can reuse document objects and
+* nested objects from `documents`. Mutating a reused object through the
+* result also changes the input.
+*
+* Sets `_rev` to `transactionId` on created, replaced, and patched documents.
+* Uses `timestamp` for timestamps unless the mutation preserves them.
+* Ignores `merge` patches; `inc` and `dec` skip values that are not numbers.
+* Generates document IDs when omitted or ending in `.`.
+* Patch operations can generate missing array keys.
+*
+* Does not persist documents or run Content Lake's server validation.
 *
-* The given `transactionId` will be used as the resulting `_rev` for documents
-* affected by the given set of mutations.
+* @throws If a selection uses a query, a `create` targets an existing document,
+* or a `patch` targets a document that does not exist.
+* @throws If a patch operation fails, including a revision check failure or
+* `diffMatchPatch` applied to a value other than a string or `undefined`.
 *
-* If a `timestamp` is given, that will be used as for the relevant `_updatedAt`
-* and `_createdAt` timestamps.
+* @internal
 */
 function processMutations({ documents, mutations, transactionId, timestamp }) {
 	if (!mutations.length) return documents;
@@ -1336,36 +1666,6 @@ function processMutations({ documents, mutations, transactionId, timestamp }) {
 	}
 	return dataset;
 }
-function _typeof(o) {
-	"@babel/helpers - typeof";
-	return _typeof = typeof Symbol == "function" && typeof Symbol.iterator == "symbol" ? function(o) {
-		return typeof o;
-	} : function(o) {
-		return o && typeof Symbol == "function" && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
-	}, _typeof(o);
-}
-function toPrimitive(t, r) {
-	if (_typeof(t) != "object" || !t) return t;
-	var e = t[Symbol.toPrimitive];
-	if (e !== void 0) {
-		var i = e.call(t, r || "default");
-		if (_typeof(i) != "object") return i;
-		throw TypeError("@@toPrimitive must return a primitive value.");
-	}
-	return (r === "string" ? String : Number)(t);
-}
-function toPropertyKey(t) {
-	var i = toPrimitive(t, "string");
-	return _typeof(i) == "symbol" ? i : i + "";
-}
-function _defineProperty(e, r, t) {
-	return (r = toPropertyKey(r)) in e ? Object.defineProperty(e, r, {
-		value: t,
-		enumerable: !0,
-		configurable: !0,
-		writable: !0
-	}) : e[r] = t, e;
-}
 var OutOfSyncError = class extends Error {
 	constructor(message, state) {
 		super(message), _defineProperty(
@@ -4228,6 +4528,23 @@ function resolveProjection(...args) {
 */
 const _resolveProjection = bindActionByResourceAndPerspective(projectionStore, ({ instance }, options) => firstValueFrom(getProjectionState(instance, options).observable.pipe(filter((state) => !!state?.data))));
 /**
+* Preserves a projection string's literal type and returns the string unchanged.
+* Use this import when migrating an app with existing experimental Typegen output.
+*
+* Current Typegen does not scan this helper. New or changed projections need an
+* explicit result type until projection generation is supported.
+*
+* @example
+* ```ts
+* const preview = defineProjection('{title, "author": author->name}')
+* ```
+*
+* @beta
+*/
+function defineProjection(projection) {
+	return projection;
+}
+/**
 * @public
 * Extracts the project ID from a CorsOriginError message.
 * @param error - The error to extract the project ID from.
@@ -4265,6 +4582,6 @@ function isImportError(error) {
 	let message = error.message || "";
 	return /Loading chunk [\w-]+ failed/i.test(message) || /Failed to fetch dynamically imported module/i.test(message) || /error loading dynamically imported module/i.test(message) || /Import(?:ing)? a module script failed/i.test(message) || /Unable to preload CSS/i.test(message);
 }
-export { AuthStateType, CORE_SDK_VERSION, application, applications, applyDocumentActions, archiveRelease, checkPermissions, configureLogging, createComment, createDatasetHandle, createDocument, createDocumentHandle, createDocumentTypeHandle, createProjectHandle, createRelease, createSanityInstance, datasets, deleteApplication, deleteDocument, deleteRelease, discardDocument, editDocument, editRelease, favorites, getActiveReleasesState, getAllReleasesState, getAuthState, getClient, getClientState, getCommentThreadsState, getCommentsState, getCorsErrorProjectId, getCurrentUserState, getDashboardOrganizationId, getDocumentPresence, getDocumentState, getDocumentSyncStatus, getIndexForKey, getIsInDashboardState, getLoginUrlState, getPathDepth, getPermissionsState, getPerspectiveState, getPresence, getProjectionState, getQueryState, getReleaseDocumentId, getTokenState, getUserState, getUsersState, handleAuthCallback, installation, installations, isCanvasResource, isDatasetResource, isImportError, isMediaLibraryResource, joinPaths, jsonMatch, loadMoreUsers, logout, observeOrganizationVerificationState, organization, organizations, project, projects, publishDocument, publishRelease, removeComment, replyToComment, reportPresence, resolveCommentThreads, resolveComments, resolveDocument, resolvePermissions, resolveProjection, resolveQuery, resolveUser, resolveUsers, scheduleRelease, setAuthToken, setCommentStatus, setFavorite, slicePath, stringifyPath, subscribeDocumentEvents, unarchiveRelease, unpublishDocument, unscheduleRelease, updateApplication, updateComment };
+export { AuthStateType, CORE_SDK_VERSION, application, applications, applyDocumentActions, archiveRelease, checkPermissions, configureLogging, createComment, createDatasetHandle, createDocument, createDocumentHandle, createDocumentTypeHandle, createProjectHandle, createRelease, createSanityInstance, datasets, defineProjection, deleteApplication, deleteDocument, deleteRelease, discardDocument, editDocument, editRelease, favorites, getActiveReleasesState, getAllReleasesState, getAuthState, getClient, getClientState, getCommentThreadsState, getCommentsState, getCorsErrorProjectId, getCurrentUserState, getDashboardOrganizationId, getDocumentPresence, getDocumentState, getDocumentSyncStatus, getIndexForKey, getIsInDashboardState, getLoginUrlState, getOAuthTokensState, getPathDepth, getPermissionsState, getPerspectiveState, getPresence, getProjectionState, getQueryState, getReleaseDocumentId, getTokenState, getUserState, getUsersState, handleAuthCallback, handleOAuthCallback, installation, installations, isCanvasResource, isDatasetResource, isImportError, isMediaLibraryResource, joinPaths, jsonMatch, loadMoreUsers, logout, observeOrganizationVerificationState, organization, organizations, patchOperations, processMutations, project, projects, publishDocument, publishRelease, refreshOAuthTokens, removeComment, replyToComment, reportPresence, resolveCommentThreads, resolveComments, resolveDocument, resolvePermissions, resolveProjection, resolveQuery, resolveUser, resolveUsers, revokeOAuthTokens, scheduleRelease, setAuthToken, setCommentStatus, setFavorite, slicePath, startOAuthAuthorization, stringifyPath, subscribeDocumentEvents, unarchiveRelease, unpublishDocument, unscheduleRelease, updateApplication, updateComment };
 
 //# sourceMappingURL=index.js.map